CVE-2026-112394: python pillow

CVSS 8.2 (high) · published 2026-10-19

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.

Affected products (NVD): python pillow

Fixed in (NVD): 13.0.0

Weakness: CWE-126

Source: NVD CVE-2026-112394

References

• https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.